@onesub/server 0.21.2 → 0.22.0

package/dist/__tests__/webhook-google-mount.test.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `POST /onesub/webhook/google` is mounted only for deployments that serve
+ * Google Play.
+ *
+ * Why it is conditional at all: unlike Apple's route, it does not authenticate
+ * unconditionally — the Pub/Sub OIDC token is verified only when an app declares
+ * a `pushAudience` — and its voided-purchase branch needs no Google credentials
+ * to run. It cancels a subscription by `purchaseToken`, or deletes a purchase row
+ * by `orderId`, straight from the payload. So an Apple-only deployment used to
+ * expose an unauthenticated endpoint that could revoke entitlement, with no
+ * Google purchases for it to be about.
+ *
+ * Apple's route stays unconditional, and this file asserts that too: it verifies
+ * the `signedPayload` JWS against the bundled Apple roots on every request
+ * regardless of config, so it is not open in the same way.
+ */
+export {};
+//# sourceMappingURL=webhook-google-mount.test.d.ts.map

package/dist/__tests__/webhook-google-mount.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-google-mount.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/webhook-google-mount.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/index.cjs

@@ -1751,18 +1751,22 @@ var GOOGLE_FAILURE_MESSAGES = {
     message: "Failed to process notification"
   }
 };
+function servesGoogle(config) {
+  return getAppRegistry(config).apps.some((app) => !!app.google);
+}
 function warnIfGoogleWebhookOpen(config) {
   if (process.env["NODE_ENV"] !== "production") return;
+  if (!servesGoogle(config)) return;
   const apps = getAppRegistry(config).apps;
   const googleApps = apps.map((a) => a.google).filter((g) => !!g);
-  if (googleApps.length > 0 && !googleApps.some((g) => g.pushAudience)) {
+  if (!googleApps.some((g) => g.pushAudience)) {
     log.warn(
       "[onesub] SECURITY: POST /onesub/webhook/google accepts unauthenticated requests \u2014 no configured app sets google.pushAudience, so the Pub/Sub OIDC token is never verified. A caller who knows a purchaseToken or orderId can cancel a subscription or delete a one-time purchase. Set google.pushAudience (and google.pushServiceAccountEmail)."
     );
   }
   if (!apps.some((a) => a.google?.packageName)) {
     log.warn(
-      "[onesub] POST /onesub/webhook/google is in open mode \u2014 no configured app declares google.packageName, so notifications for ANY package are accepted. The route is mounted whether or not Google is configured; set google.packageName, or block the path at your proxy if this deployment does not serve Google Play."
+      "[onesub] POST /onesub/webhook/google is in open mode \u2014 no configured app declares google.packageName, so notifications for ANY package are accepted. Set google.packageName on each app you serve."
     );
   }
 }
@@ -1981,10 +1985,12 @@ function createWebhookRouter(config, store, purchaseStore, webhookEventStore, we
     shared.ROUTES.WEBHOOK_APPLE,
     (req, res) => handleAppleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue)
   );
-  router.post(
-    shared.ROUTES.WEBHOOK_GOOGLE,
-    (req, res) => handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue)
-  );
+  if (servesGoogle(config)) {
+    router.post(
+      shared.ROUTES.WEBHOOK_GOOGLE,
+      (req, res) => handleGoogleWebhook(req, res, config, store, purchaseStore, webhookEventStore, webhookQueue)
+    );
+  }
   return router;
 }
 var NO_PURCHASE = { valid: false, purchase: null };